HORKimhab/CVE-Wordpress

GitHubRepository PoCExploit

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The primary artifact is a Python script (CVE-2026-49777.py) that attempts to exploit CVE-2026-49777 by triggering a malicious software download endpoint on a target WordPress site. It includes functions to detect the vulnerable plugin, send crafted HTTP requests to known vulnerable endpoints, and check for indicators of compromise. The script's stated purpose is to achieve unauthenticated remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC scripts are exploit tools targeting disclosed WordPress plugin backdoors (CVE-2026-49777, CVE-2026-10735). They perform IOC detection, login bypass, REST API file write, webshell RCE, and data exfiltration against remote targets. All actions are directed at the operator-supplied target URL; no evidence of concealed local execution, data exfiltration to an undisclosed third party, or other deceptive harm to the operator was found.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareWordPressProduct Slider Pro for WooCommerce
Attack typesRemote Code ExecutionMalicious Software Implantation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary function is to exploit a vulnerability by sending crafted requests to trigger a malicious software download, which is the definition of an exploit. The code includes functions named 'exploit_rce' and attempts to achieve remote code execution, not just detect the vulnerability.

woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:194-305woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:430-434

Requirements

  • Target must have a vulnerable version of Product Slider Pro for WooCommerce plugin installed.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:111-115
  • Target must be a WordPress site.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:118-123

Observed behavior

  • Detects the presence and version of the Product Slider Pro for WooCommerce plugin by requesting readme.txt files.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:135-191
  • Sends GET and POST requests to known vulnerable endpoints (e.g., admin-ajax.php) with crafted parameters to trigger a remote payload download.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:194-305
  • Checks for suspicious files and directories that may indicate prior compromise.woocommerce-plugin-supply-chain-security-assessment-amnsecurity/CVE-2026-49777.py:308-343
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://t.me/toolsandpocTelegram contact link displayed in the banner and README of the PoC. This is author contact information and does not constitute a backdoor.CVE-2026-49777-CVE-2026-10735-xxconi/CVE-2026-49777.py:42CVE-2026-49777-CVE-2026-10735-xxconi/README.md:2
Url
https://gist.githubusercontent.com/HORKimhab/24c89ee9a86a42aac88381334f8bfe48/rawA curl-to-bash command in the README instructs the operator to download and execute a script to 'clear nested dir .git'. This is a suspicious instruction, but the script content is not provided in the evidence, so its behavior cannot be confirmed as harmful.README.md:21
Command
curl -fsSL https://gist.githubusercontent.com/HORKimhab/24c89ee9a86a42aac88381334f8bfe48/raw | bash -s -- -yThe README instructs the operator to pipe a remote script into bash. This is a high-risk operation, but without the script content, it cannot be classified as a trojan.README.md:21
Review boundaries

What the analysis did not establish

  • The evidence includes a second Python script (CVE-2026-49777-CVE-2026-10735-xxconi/CVE-2026-49777.py) that is a more comprehensive exploit with login bypass, REST API backdoor, and webshell RCE, but the primary artifact for classification is the one explicitly named for CVE-2026-49777.
  • The analysis is based solely on static code review; the code was not executed, and its effectiveness is not verified.
  • The artifact's behavior description is derived from its source code, not from observed runtime actions.
  • The curl-to-bash script referenced in README.md is not included in the evidence, so its behavior cannot be reviewed.
  • Five text files and one non-text file in the repository were omitted from the evidence packet; their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2